fix(token-vault): reliably end the AM SSO session on logout (SDKS-5448)

.changeset/shaggy-owls-beg.md

@@ -0,0 +1,5 @@
+---
+'@forgerock/token-vault': patch
+---
+
+Add sessions/ endpoint to fully complete logout

packages/token-vault/src/lib/network/network.utilities.test.ts

@@ -108,6 +108,7 @@ describe('Test network utility functions', () => {
       accessToken: 'https://example.com/am/oauth2/realms/root/access_token',
       revoke: 'https://example.com/am/oauth2/realms/root/token/revoke',
       session: 'https://example.com/am/oauth2/realms/root/connect/endSession?',
+      sessions: 'https://example.com/am/json/realms/root/sessions',
       userInfo: 'https://example.com/am/oauth2/realms/root/userinfo',
     });
   });
@@ -124,6 +125,7 @@ describe('Test network utility functions', () => {
       accessToken: 'https://example.com/am/oauth2/realms/root/realms/alpha/access_token',
       revoke: 'https://example.com/am/oauth2/realms/root/realms/alpha/token/revoke',
       session: 'https://example.com/am/oauth2/realms/root/realms/alpha/connect/endSession?',
+      sessions: 'https://example.com/am/json/realms/root/realms/alpha/sessions',
       userInfo: 'https://example.com/am/oauth2/realms/root/realms/alpha/userinfo',
     });
   });

packages/token-vault/src/lib/network/network.utilities.ts

@@ -1,6 +1,6 @@
 /**
  *
- * Copyright (c) 2023 - 2025 Ping Identity Corporation. All right reserved.
+ * Copyright (c) 2023 - 2026 Ping Identity Corporation. All right reserved.
  *
  * This software may be modified and distributed under the terms
  * of the MIT license. See the LICENSE file for details.
@@ -146,6 +146,7 @@ export function generateAmUrls(forgerockConfig: ConfigOptions) {
     accessToken: `${resolveUrl(baseUrl, getEndpointPath('accessToken', realmPath))}`,
     revoke: `${resolveUrl(baseUrl, getEndpointPath('revoke', realmPath))}`,
     session: `${resolveUrl(baseUrl, getEndpointPath('endSession', realmPath))}?`,
+    sessions: `${resolveUrl(baseUrl, getEndpointPath('sessions', realmPath))}`,
     userInfo: `${resolveUrl(baseUrl, getEndpointPath('userInfo', realmPath))}`,
   };
 }

packages/token-vault/src/lib/proxy.ts

@@ -270,6 +270,32 @@ export function proxy(config: ProxyConfig) {
       return;
     }
 
+    /** ****************************************************
+     * SESSIONS ENDPOINT
+     * Authenticated by the AM session cookie, not a Bearer
+     * token, and must run even when tokens are absent
+     */
+    if (request.url?.includes('/sessions')) {
+      const url = new URL(amUrlObj.sessions);
+      url.search = new URL(requestUrl).search;
+
+      let response;
+      try {
+        response = await fetch(url.toString(), {
+          ...request.options,
+          credentials: 'include',
+        });
+      } catch (error) {
+        const errorResponse = createErrorResponse('fetch_error', error);
+        responseChannel.postMessage(errorResponse);
+        return;
+      }
+
+      const clonedResponse = await cloneResponse(response);
+      responseChannel.postMessage(clonedResponse);
+      return;
+    }
+
     // The remainder of events require tokens to be present
     if (!tokens) {
       const errorResponse = createErrorResponse(

packages/token-vault/src/lib/worker/worker.utilities.test.ts

@@ -30,6 +30,7 @@ test('generateUrlsToIntercept returns the expected array of URLs', () => {
     'https://openam.forgerock.com/am/oauth2/realms/root/connect/endSession?',
     'https://openam.forgerock.com/am/oauth2/realms/root/token/revoke',
     'https://openam.forgerock.com/am/oauth2/realms/root/userinfo',
+    'https://openam.forgerock.com/am/json/realms/root/sessions*',
   ];
 
   expect(generateUrlsToIntercept(config)).toEqual(expectedUrls);
@@ -56,6 +57,7 @@ test('generateUrlsToIntercept returns the expected array of URLs with /alpha as
     'https://openam.forgerock.com/am/oauth2/realms/root/realms/alpha/connect/endSession?',
     'https://openam.forgerock.com/am/oauth2/realms/root/realms/alpha/token/revoke',
     'https://openam.forgerock.com/am/oauth2/realms/root/realms/alpha/userinfo',
+    'https://openam.forgerock.com/am/json/realms/root/realms/alpha/sessions*',
   ];
 
   expect(generateUrlsToIntercept(config)).toEqual(expectedUrls);

packages/token-vault/src/lib/worker/worker.utilities.ts

@@ -1,6 +1,6 @@
 /**
  *
- * Copyright (c) 2023 - 2025 Ping Identity Corporation. All right reserved.
+ * Copyright (c) 2023 - 2026 Ping Identity Corporation. All right reserved.
  *
  * This software may be modified and distributed under the terms
  * of the MIT license. See the LICENSE file for details.
@@ -30,6 +30,7 @@ export function generateUrlsToIntercept(config: InterceptorConfig) {
     `${resolveUrl(forgerockBaseUrl, getEndpointPath('endSession', realmPath))}?`,
     `${resolveUrl(forgerockBaseUrl, getEndpointPath('revoke', realmPath))}`,
     `${resolveUrl(forgerockBaseUrl, getEndpointPath('userInfo', realmPath))}`,
+    `${resolveUrl(forgerockBaseUrl, getEndpointPath('sessions', realmPath))}*`,
   ];
   return urls;
 }